Executive Summary
A SQL injection vulnerability, tracked as CVE-2026-90495, has been disclosed in Feng Office, an open-source collaboration and project management suite, affecting versions up to and including 3.11.13.11. The flaw sits in the Legacy API component, specifically in the Contacts::instance->findAll function inside application/models/CompanyWebsite.class.php, where the auth argument is passed into a database query without proper sanitization.
CVSS Score: 7.3 (High)
The vulnerability can be triggered remotely and does not require authentication, making it exploitable by any attacker with network access to a vulnerable instance. Technical details and a proof-of-concept exploit are already public, which sharply raises the urgency for affected operators.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-90495 |
| CWE | CWE-89 (SQL Injection) |
| CVSS Score | 7.3 (High) |
| Component | Legacy API — CompanyWebsite.class.php |
| Affected Function | Contacts::instance->findAll |
| Affected Parameter | auth |
| Attack Vector | Network (remote) |
| Authentication | None required |
| Exploit Status | Public PoC available |
| Vendor Response | None at time of writing |
Affected Versions
| Product | Affected Versions | Fixed Version |
|---|---|---|
| Feng Office | ≤ 3.11.13.11 | Not yet published |
The vendor was notified of the disclosure but has not responded, and no patched release is currently available. Administrators should treat any future release beyond 3.11.13.11 as the presumed fix and verify against the Feng Office project once an update ships.
Why This Matters
Feng Office is used by small and mid-sized organizations to manage projects, contacts, and internal collaboration data, often on self-hosted infrastructure with minimal external monitoring. An unauthenticated SQL injection in this context is significant because:
- No credentials are needed — any network-positioned attacker can attempt exploitation directly against the Legacy API endpoint.
- The vulnerable code path handles contact and company records, meaning successful exploitation can expose customer and business contact data stored in the underlying database.
- The affected file path (
application/models/CompanyWebsite.class.php) is predictable and discoverable through simple search-engine dorking, lowering the bar for opportunistic scanning. - A working exploit is already public, which typically shortens the window between disclosure and mass exploitation attempts.
Recommended Actions
- Identify exposure — confirm whether your Feng Office instance is reachable from the internet and check the installed version.
- Restrict network access to the Legacy API where possible; place the application behind a VPN or IP allowlist if it does not need to be public-facing.
- Deploy WAF rules to detect and block SQL-injection payloads targeting the
authparameter and theCompanyWebsite.class.phpendpoint specifically. - Monitor database and application logs for anomalous queries or unexpected access to the
Contactsmodel. - Since no vendor patch exists, consider disabling or isolating the Legacy API component if it is not actively required, or evaluate migrating away from Feng Office if the vendor remains unresponsive.
- Rotate any credentials stored in or accessible via the affected database if compromise is suspected.